TRACE DEMOSecurity Posture
Back to trace demo

Security Operations

19 services · 5 platforms · 2026-09-09
5/16
Last check: 5 failed
10/16, 04:57 · 15/19 reachable
0
Critical and high open
18
Fix commits
26/30
OWASP categories reviewed
AssetsBy risk · 19

check failed > unreachable > attacked > audit findings > severity > count

Attacked1
Audit findings, fixed13
5 sites with no findings and 0 open advisories, show list
21
Requests
6
Database errors
4
Source addresses
38s
Duration
T+38.0s
Probe · extraction
Column count search
Baseline request
T+38.0s
22:49:30+10s+20s+30s22:50:08
Injection point probeColumn count binary searchError based extractionBaseline request/defects/wafer-map · defect_type
Extraction failed every time The tool used a function specific to one database while the real backend is a different query engine that has no such function, so the route of pushing data into an error message never worked once. No data retrieval request appeared Nothing in the whole log tried to pull data out, everything stopped at the detection stage. The tool could not identify the database type and gave up after 38 seconds. The vulnerability was real The requests carrying a comment marker returned 200, which means the input really was executed as query syntax. A tool matched to the right database type would have succeeded.
Probe detail · 22:49:30 · 54.164.184.236500
Parameter value sent
defect_type=') AND ('snubmm'='snubmm'

Check whether the parameter reaches the query string directly

Sends a string that closes the quote. If the response turns into a database syntax error, the input reached the query directly.

Query before the fix
SELECT location_x, location_y, defect_type, severity, size_um
FROM defects
WHERE defect_type = '') AND ('snubmm'='snubmm''
LIMIT 2000
Query after the fix
SELECT location_x, location_y, defect_type, severity, size_um
FROM defects
WHERE defect_type = @defect_type
LIMIT 2000
Incident history1 incidents · Imported 2026-10-08 22:05 UTC · 24h lookback
Watching 24 error monitoring project(s) · ai-english-tutor, ai-red-team, amc-analytics, dashai-api, dashai-go, fab-analytics, factory-designer, gotech-demo, jinkochino, jlpt-n1-learner, motion-study, nicegarden, nicegarden-api, seikai-dev, shopfloor, shukuyo, shukuyo-next, shukuyo-web, smai-demo-backend, smai-demo-frontend, smart-factory-demo, studio-site, toeic-practice, trace-demo
TimeTargetRequestsDurationSources
09/07, 22:49Curatedfab-analytics.seikai.dev/defects/wafer-map2138s4
Check logQueued daily 08:37 (Asia/Taipei)
Queued is not run. GitHub delays scheduled events under load; measured delay here is 4 to 4.6 hours. The actual time of each run is in the log below.
10/16, 04:57Scheduled5/16 · 15/19
10/15, 05:07Scheduled5/16 · 15/19
10/14, 08:48Manual5/16 · 15/19
10/14, 05:19Scheduled11/16 · 16/19
10/13, 07:04Scheduled5/16 · 15/19
10/12, 06:28Scheduled8/16 · 17/19
10/11, 06:24Scheduled8/16 · 17/19
10/10, 06:21Scheduled8/16 · 17/19
10/09, 06:39Scheduled8/16 · 17/19
10/08, 06:37Scheduled14/16 · 18/19
10/07, 06:24Scheduled8/16 · 17/19
10/06, 06:49Scheduled14/16 · 18/19
Fix commits18
82746c9dashai-go
feat(security): identify scanner traffic and lay decoy paths
4958cecnicegarden-api
feat(security): identify scanner traffic and lay decoy paths
92e7614dashai-api
feat(security): identify scanner traffic and lay decoy paths
3ab7405nicegarden
feat(admin): one-click regenerate for the backend demo data
f42417fnicegarden-api
fix(auth): remove the hardcoded shared PIN and add a rotation path
da4c77eshopfloor
fix(login): stop shipping the shared employee PIN in the public bundle
d71eea2nicegarden-api
fix(haccp,audit): gate HACCP writes, take recorder from JWT, fix audit amplifier
5f2cae9go-ot-security
feat(agent): authenticate scan reports to the coordinator
44e830edashai-go
fix(infra): require a shared API key on /security, /edge and /events
6ec4b2anicegarden-api
fix(wms): reject non-finite quantities, expire auto-locks, scope work-order writes
9b28335dashai-go
fix(shukuyo): make company_cache insert-only and scope item upserts to owner
35a0401smart-factory-demo
feat(about): make the demo reset button work via admin key
680b3e8dashai-api
fix(factory): require admin key for CRUD writes, keep reads public
7a074a6dashai-api
fix(security): close unauthenticated write paths on the shared gateway
318ceabdashai-go
fix(gateway): cap request bodies and batch sizes, upgrade vulnerable deps
a7b10c6dashai-api
fix(smai): bound wafer-map/sensors limit to reject negative values
113c4bashopfloor
fix(proxy): close unauth executive access to nicegarden API via HACCP proxy
35d0447dashai-api
fix(smai): parameterize BigQuery filters to close SQL injection
Own projects and demo environments. Client related details are anonymized. The techniques shown are publicly known and the matching vulnerabilities are fixed.